asyncapi vulnerabilities

Products

• @asyncapi/java-spring-cloud-stream-template 1
• @asyncapi/modelina 1

Latest asyncapi CVEs

Newest publication first

1. CVE-2023-23619 Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina

   Published 2023-01-26

   High·CVSS 8.8 EPSS 1.1%

   Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality them...

2. CVE-2021-37694 Code injection issue for java-spring-cloud-stream-template

   Published 2021-08-11

   High·CVSS 7.8 EPSS 0.88%

   @asyncapi/java-spring-cloud-stream-template generates a Spring Cloud Stream (SCSt) microservice. In versions prior to 0.7.0 arbitrary code injection was possible when an attacker controls the AsyncAPI document. An example is provided in GHSA-xj6r-2jpm-qvxp. There are no mitigatio...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.